@zudojs/http 1.1.0 → 1.3.0

package/dist/httpRouter/core/register/httpRouter.register.js

@@ -4,9 +4,9 @@
 import { HttpRouterError, RouteConflictError, } from "../error/httpRouter.error.js";
 import { HttpRouterGroup } from "../group/httpRouterGroup.core.js";
 import { collectAllowedMethods, createFallbackRoute, createOptionsResponse, defaultMethodNotAllowedHandler, defaultNotFoundHandler, executeRoute, extractRouteSequence, isHttpMethod, normalizeMethod, normalizeMethods, normalizeResponse, } from "../factory/httpRoute.factory.base.js";
-import { getRequestMethod, getRequestSignal, getRequestUrl, normalizePath, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
+import { getRequestMethod, getRequestSignal, getRequestUrl, normalizeMatchPath, normalizePath, normalizeRoutePattern, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
 import { matchCompiledRoute } from "../../matching/httpRoute.matcher.core.js";
-import { compileRoute } from "../../pattern/httpRoute.pattern.parse.js";
+import { compareSegmentSpecificity, compileRoute, } from "../../pattern/httpRoute.pattern.parse.js";
 import { createRouterMiddlewareContext } from "../../httpRouter.context.js";
 export class HttpRouter {
     routes = [];
@@ -90,7 +90,7 @@ export class HttpRouter {
     remove(method, path) {
         const normalizedMethod = normalizeMethod(method);
         const index = this.routes.findIndex((route) => route.definition.method === normalizedMethod &&
-            route.definition.path === normalizePath(path));
+            route.definition.path === normalizeRoutePattern(path));
         if (index === -1) {
             return false;
         }
@@ -122,11 +122,13 @@ export class HttpRouter {
     match(method, path) {
         const normalizedMethod = method.toUpperCase();
         const normalizedPath = normalizePath(path);
+        const matchPath = normalizeMatchPath(path);
         const candidates = this.sortedRoutes();
+        const allowedForPath = () => collectAllowedMethods(candidates, matchPath, this.routerOptions.caseSensitive);
         const allowed = new Set();
         let pathMatched = false;
         for (const route of candidates) {
-            const params = matchCompiledRoute(route, normalizedPath, this.routerOptions.caseSensitive);
+            const params = matchCompiledRoute(route, matchPath, this.routerOptions.caseSensitive);
             if (!params) {
                 continue;
             }
@@ -137,9 +139,7 @@ export class HttpRouter {
                     matched: true,
                     route: route.definition,
                     params,
-                    allowedMethods: Object.freeze([
-                        ...collectAllowedMethods(candidates, normalizedPath),
-                    ]),
+                    allowedMethods: Object.freeze([...allowedForPath()]),
                     path: normalizedPath,
                     method: normalizedMethod,
                 };
@@ -153,16 +153,13 @@ export class HttpRouter {
                 if (route.definition.method !== "GET") {
                     continue;
                 }
-                const params = matchCompiledRoute(route, normalizedPath, this.routerOptions.caseSensitive);
+                const params = matchCompiledRoute(route, matchPath, this.routerOptions.caseSensitive);
                 if (params) {
                     return {
                         matched: true,
                         route: route.definition,
                         params,
-                        allowedMethods: Object.freeze([
-                            ...collectAllowedMethods(candidates, normalizedPath),
-                            "HEAD",
-                        ]),
+                        allowedMethods: Object.freeze([...allowedForPath(), "HEAD"]),
                         path: normalizedPath,
                         method: normalizedMethod,
                     };
@@ -176,10 +173,7 @@ export class HttpRouter {
                 matched: true,
                 route: undefined,
                 params: {},
-                allowedMethods: Object.freeze([
-                    ...collectAllowedMethods(candidates, normalizedPath),
-                    "OPTIONS",
-                ]),
+                allowedMethods: Object.freeze([...allowedForPath(), "OPTIONS"]),
                 path: normalizedPath,
                 method: normalizedMethod,
             };
@@ -261,11 +255,11 @@ export class HttpRouter {
     /* ------------------------------------------------------------------------ */
     register(method, path, handler, options) {
         const normalizedMethod = normalizeMethod(method);
-        const normalizedPath = normalizePath(path);
+        const normalizedPath = normalizeRoutePattern(path);
         if (typeof handler !== "function") {
             throw new HttpRouterError("Route handler must be a function.");
         }
-        const compiled = compileRoute(normalizedPath, this.routerOptions.strictTrailingSlash ||
+        const compiled = compileRoute(path, this.routerOptions.strictTrailingSlash ||
             options.strictTrailingSlash === true);
         const existing = this.routes.find((route) => route.definition.method === normalizedMethod &&
             route.definition.path === normalizedPath);
@@ -290,6 +284,7 @@ export class HttpRouter {
             segments: compiled.segments,
             score: compiled.score,
             strictTrailingSlash: compiled.strictTrailingSlash,
+            expectsTrailingSlash: compiled.expectsTrailingSlash,
         });
         return () => {
             this.remove(normalizedMethod, normalizedPath);
@@ -297,9 +292,9 @@ export class HttpRouter {
     }
     sortedRoutes() {
         return [...this.routes].sort((left, right) => {
-            const score = right.score - left.score;
-            if (score !== 0) {
-                return score;
+            const specificity = compareSegmentSpecificity(left.segments, right.segments);
+            if (specificity !== 0) {
+                return specificity;
             }
             return (extractRouteSequence(left.definition.id) -
                 extractRouteSequence(right.definition.id));

package/dist/httpRouter/core/types/httpRouter.type.d.ts

@@ -104,6 +104,12 @@ export interface CompiledRoute {
     readonly segments: readonly CompiledSegment[];
     readonly score: number;
     readonly strictTrailingSlash: boolean;
+    /**
+     * Whether the registered pattern ended with a slash.
+     *
+     * Only consulted when {@link CompiledRoute.strictTrailingSlash} is set.
+     */
+    readonly expectsTrailingSlash?: boolean;
 }
 export { HttpRouterError, RouteConflictError, } from "../error/httpRouter.error.js";
 //# sourceMappingURL=httpRouter.type.d.ts.map

package/dist/httpRouter/core/util/httpRoute.util.d.ts

@@ -8,10 +8,71 @@ import type { HttpRequestContext as RequestContext } from "../../../httpRequest/
 export declare function getRequestMethod(request: RequestContext): string;
 export declare function getRequestUrl(request: RequestContext): string;
 export declare function getRequestSignal(request: RequestContext): AbortSignal | undefined;
+/**
+ * Parses a request-target with the canonical parser shared by the request
+ * context and path-scoped middleware.
+ */
 export declare function parseUrl(value: string): URL;
+/**
+ * Builds the router's query record.
+ *
+ * Uses the same parser as the Node adapter's `request.query`
+ * (`parseQueryString`): a repeated name is an array, the record has a `null`
+ * prototype, and `__proto__` / `constructor` / `prototype` are dropped. The
+ * two used to disagree (`ctx.query.role` an array, `request.getQuery("role")`
+ * the last value), which let middleware and handlers read different values
+ * for the same parameter.
+ */
 export declare function parseQuery(params: URLSearchParams): Readonly<Record<string, string | string[]>>;
+/**
+ * Normalizes a **request** path.
+ *
+ * Strips the query string, forces a leading slash, collapses repeated
+ * slashes, and trims a trailing slash.
+ *
+ * This must not be used on a route *pattern*: a pattern may legitimately
+ * contain `?` (the optional-parameter marker), which this function treats as
+ * the start of a query string. Use {@link normalizeRoutePattern} for
+ * patterns.
+ */
 export declare function normalizePath(path: string): string;
+/**
+ * Normalizes a request path while preserving a single trailing slash.
+ *
+ * The trailing slash is the only information a strict-trailing-slash route
+ * needs and {@link normalizePath} destroys it, so matching runs on this
+ * spelling instead.
+ *
+ * @param path - The raw request path, possibly with a query or fragment.
+ * @returns The normalized path, keeping one trailing slash if present.
+ */
+export declare function normalizeMatchPath(path: string): string;
+/**
+ * Normalizes a route **pattern**.
+ *
+ * Identical to {@link normalizePath} except that `?` is left alone, so the
+ * documented optional-parameter syntax (`/users/:id?`, `/files/{name?}`)
+ * survives registration.
+ *
+ * @param pattern - The raw route pattern.
+ * @returns The normalized pattern.
+ */
+export declare function normalizeRoutePattern(pattern: string): string;
+/**
+ * Reports whether a path carries a meaningful trailing slash.
+ *
+ * @param path - The path to inspect.
+ * @returns `true` when the path ends with `/` and is not the root path.
+ */
+export declare function hasTrailingSlash(path: string): boolean;
 export declare function splitPath(path: string): string[];
+/**
+ * Splits a route pattern into its segments, keeping `?` markers intact.
+ *
+ * @param pattern - The raw route pattern.
+ * @returns The pattern's non-empty segments.
+ */
+export declare function splitRoutePattern(pattern: string): string[];
 export declare function validateParameterName(name: string, path: string): void;
 export declare function decodeRouteValue(value: string): string;
 /**

package/dist/httpRouter/core/util/httpRoute.util.js

@@ -4,6 +4,8 @@
  * Request accessors, URL/query parsing, and path normalization shared by the
  * router core.
  */
+import { parseRequestTarget } from "../../../httpRequest/target/httpRequest.target.js";
+import { parseQueryString } from "../../../httpQuery/index.js";
 import { InvalidRoutePatternError } from "../error/httpRouter.error.js";
 export function getRequestMethod(request) {
     const value = request.method;
@@ -19,35 +21,105 @@ export function getRequestUrl(request) {
 export function getRequestSignal(request) {
     return request.signal;
 }
+/**
+ * Parses a request-target with the canonical parser shared by the request
+ * context and path-scoped middleware.
+ */
 export function parseUrl(value) {
-    try {
-        return new URL(value, "http://zudojs.local");
-    }
-    catch {
-        return new URL("/", "http://zudojs.local");
-    }
+    return parseRequestTarget(value);
 }
+/**
+ * Builds the router's query record.
+ *
+ * Uses the same parser as the Node adapter's `request.query`
+ * (`parseQueryString`): a repeated name is an array, the record has a `null`
+ * prototype, and `__proto__` / `constructor` / `prototype` are dropped. The
+ * two used to disagree (`ctx.query.role` an array, `request.getQuery("role")`
+ * the last value), which let middleware and handlers read different values
+ * for the same parameter.
+ */
 export function parseQuery(params) {
-    const result = {};
-    for (const key of new Set(Array.from(params.keys()))) {
-        const values = params.getAll(key);
-        result[key] = values.length > 1 ? values : (values[0] ?? "");
-    }
-    return Object.freeze({
-        ...result,
-    });
+    return Object.freeze(parseQueryString(params.toString()));
 }
 /* -------------------------------------------------------------------------- */
 /* Path Helpers                                                               */
 /* -------------------------------------------------------------------------- */
+/**
+ * Normalizes a **request** path.
+ *
+ * Strips the query string, forces a leading slash, collapses repeated
+ * slashes, and trims a trailing slash.
+ *
+ * This must not be used on a route *pattern*: a pattern may legitimately
+ * contain `?` (the optional-parameter marker), which this function treats as
+ * the start of a query string. Use {@link normalizeRoutePattern} for
+ * patterns.
+ */
 export function normalizePath(path) {
     if (!path || path === "") {
         return "/";
     }
     const withoutQuery = path.split("?", 1)[0] ?? path;
-    let normalized = withoutQuery.startsWith("/")
-        ? withoutQuery
-        : `/${withoutQuery}`;
+    return collapsePath(withoutQuery);
+}
+/**
+ * Normalizes a request path while preserving a single trailing slash.
+ *
+ * The trailing slash is the only information a strict-trailing-slash route
+ * needs and {@link normalizePath} destroys it, so matching runs on this
+ * spelling instead.
+ *
+ * @param path - The raw request path, possibly with a query or fragment.
+ * @returns The normalized path, keeping one trailing slash if present.
+ */
+export function normalizeMatchPath(path) {
+    if (!path || path.trim() === "") {
+        return "/";
+    }
+    let target = path.trim();
+    if (target.startsWith("http://") || target.startsWith("https://")) {
+        try {
+            target = new URL(target).pathname;
+        }
+        catch {
+            /* Keep the original value if it is not a valid absolute URL. */
+        }
+    }
+    const withoutQuery = target.split("?", 1)[0] ?? target;
+    const withoutHash = withoutQuery.split("#", 1)[0] ?? withoutQuery;
+    const collapsed = collapsePath(withoutHash);
+    return hasTrailingSlash(withoutHash) && collapsed !== "/"
+        ? `${collapsed}/`
+        : collapsed;
+}
+/**
+ * Normalizes a route **pattern**.
+ *
+ * Identical to {@link normalizePath} except that `?` is left alone, so the
+ * documented optional-parameter syntax (`/users/:id?`, `/files/{name?}`)
+ * survives registration.
+ *
+ * @param pattern - The raw route pattern.
+ * @returns The normalized pattern.
+ */
+export function normalizeRoutePattern(pattern) {
+    if (!pattern || pattern === "") {
+        return "/";
+    }
+    return collapsePath(pattern);
+}
+/**
+ * Reports whether a path carries a meaningful trailing slash.
+ *
+ * @param path - The path to inspect.
+ * @returns `true` when the path ends with `/` and is not the root path.
+ */
+export function hasTrailingSlash(path) {
+    const trimmed = path.replace(/\/{2,}/g, "/");
+    return trimmed.length > 1 && trimmed.endsWith("/");
+}
+function collapsePath(value) {
+    let normalized = value.startsWith("/") ? value : `/${value}`;
     normalized = normalized.replace(/\/{2,}/g, "/");
     if (normalized.length > 1 && normalized.endsWith("/")) {
         normalized = normalized.slice(0, -1);
@@ -61,6 +133,19 @@ export function splitPath(path) {
     }
     return normalized.split("/").filter(Boolean);
 }
+/**
+ * Splits a route pattern into its segments, keeping `?` markers intact.
+ *
+ * @param pattern - The raw route pattern.
+ * @returns The pattern's non-empty segments.
+ */
+export function splitRoutePattern(pattern) {
+    const normalized = normalizeRoutePattern(pattern);
+    if (normalized === "/") {
+        return [];
+    }
+    return normalized.split("/").filter(Boolean);
+}
 export function validateParameterName(name, path) {
     if (!/^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(name)) {
         throw new InvalidRoutePatternError(path, `Invalid parameter name "${name}".`);

package/dist/httpRouter/dispatch/httpRoute.dispatcher.d.ts

@@ -24,6 +24,17 @@ export interface RouteDispatchContext {
 export interface RouteDispatchOptions {
     readonly onError?: RouteDispatchErrorHandler;
     readonly onComplete?: RouteDispatchCompleteHandler;
+    /**
+     * Keeps the response the middleware chain produced.
+     *
+     * By default a response returned by a route handler is merged into the
+     * response passed to `dispatch()`, overwriting its status, headers, cookies
+     * and body. With this set, the handler's response is left alone and the
+     * dispatch response is returned exactly as the middleware chain built it.
+     *
+     * The option was previously declared and never read, so it silently did
+     * nothing.
+     */
     readonly preserveResponse?: boolean;
 }
 export type RouteDispatchErrorHandler = (error: unknown, context: RouteDispatchContext) => void | Promise<void>;

package/dist/httpRouter/dispatch/httpRoute.dispatcher.js

@@ -104,7 +104,7 @@ export class RouteDispatcher {
     async execute(context) {
         const state = new RouterMiddlewareState();
         const middleware = context.route.middleware.map((layer) => toRouteMiddleware(layer, context.route, state));
-        const handler = toDispatchHandler(context.route.handler, context);
+        const handler = toDispatchHandler(context.route.handler, context, this.options.preserveResponse === true);
         let index = -1;
         const dispatchNext = async (current) => {
             if (current <= index) {
@@ -220,7 +220,7 @@ function normalizeHandler(handler) {
  * A response context returned by the handler is merged into the dispatch
  * response so the dispatcher's response object stays authoritative.
  */
-function toDispatchHandler(handler, context) {
+function toDispatchHandler(handler, context, preserveResponse = false) {
     return async (request, response) => {
         const result = await handler(createRouterContext({
             request,
@@ -228,7 +228,9 @@ function toDispatchHandler(handler, context) {
             params: context.params,
             signal: getRequestSignal(request),
         }));
-        if (result instanceof HttpResponseContext && result !== response) {
+        if (!preserveResponse &&
+            result instanceof HttpResponseContext &&
+            result !== response) {
             /*
              * Everything the handler put on its response must survive the merge.
              * Copying only status, headers and body dropped every cookie the

package/dist/httpRouter/matching/httpRoute.matcher.core.js

@@ -5,14 +5,28 @@
  * case sensitivity, optional parameters, per-parameter regular expression
  * constraints, and trailing wildcards.
  */
-import { decodeRouteSegment, normalizePath, splitPath, } from "../core/util/httpRoute.util.js";
+import { decodeRouteSegment, hasTrailingSlash, normalizePath, splitPath, } from "../core/util/httpRoute.util.js";
 export function matchCompiledRoute(route, path, caseSensitive) {
+    /*
+     * `strictTrailingSlash` used to be compiled and stored but never read, so a
+     * strict router still answered `/users/` with the `/users` route. The
+     * request path reaches this function with its trailing slash intact
+     * (`normalizeMatchPath`), so the two spellings can finally be told apart.
+     */
+    if (route.strictTrailingSlash &&
+        hasTrailingSlash(path) !== (route.expectsTrailingSlash ?? false)) {
+        return undefined;
+    }
     const routePath = normalizePath(path);
     const inputSegments = splitPath(routePath);
     const output = {};
     const routeSegments = route.segments;
     let inputIndex = 0;
-    for (const segment of routeSegments) {
+    for (let segmentIndex = 0; segmentIndex < routeSegments.length; segmentIndex += 1) {
+        const segment = routeSegments[segmentIndex];
+        if (segment === undefined) {
+            continue;
+        }
         if (segment.type === "wildcard") {
             /*
              * Decode each segment separately and re-join. Decoding the joined tail
@@ -33,10 +47,18 @@ export function matchCompiledRoute(route, path, caseSensitive) {
             break;
         }
         const input = inputSegments[inputIndex];
-        if (input === undefined &&
-            segment.type === "parameter" &&
-            segment.optional) {
-            continue;
+        if (segment.type === "parameter" && segment.optional) {
+            /*
+             * An optional parameter only claims a segment when the segments that
+             * follow it still have enough input left. Without that check
+             * `/account/:id?/profile` swallowed `profile` as the id and then found
+             * nothing to match its literal tail.
+             */
+            const remainingInput = inputSegments.length - inputIndex;
+            if (input === undefined ||
+                remainingInput <= requiredSegments(routeSegments, segmentIndex + 1)) {
+                continue;
+            }
         }
         if (input === undefined) {
             return undefined;
@@ -69,4 +91,27 @@ export function matchCompiledRoute(route, path, caseSensitive) {
     }
     return Object.freeze(output);
 }
+/**
+ * Counts the segments from `start` onwards that must consume input.
+ *
+ * Optional parameters and wildcards can match nothing, so they do not count.
+ *
+ * @param segments - The route's compiled segments.
+ * @param start - The index to count from.
+ * @returns The number of segments that require an input segment.
+ */
+function requiredSegments(segments, start) {
+    let required = 0;
+    for (let index = start; index < segments.length; index += 1) {
+        const segment = segments[index];
+        if (segment === undefined || segment.type === "wildcard") {
+            continue;
+        }
+        if (segment.type === "parameter" && segment.optional) {
+            continue;
+        }
+        required += 1;
+    }
+    return required;
+}
 //# sourceMappingURL=httpRoute.matcher.core.js.map

package/dist/httpRouter/matching/httpRoute.matcher.d.ts

@@ -51,7 +51,6 @@ export declare class RouteMatcher {
     stats(): RouteMatcherStats;
     resetStats(): void;
     private collect;
-    private matchFirstAllowed;
 }
 export declare function createRouteMatcher(router: HttpRouter, options?: RouteMatcherOptions): RouteMatcher;
 export declare function matchRoute(matcher: RouteMatcher, method: string, path: string): RouteMatcherResult | undefined;

package/dist/httpRouter/matching/httpRoute.matcher.js

@@ -5,7 +5,8 @@
  * pathname. Route registration lives in the router core; per-route segment
  * matching lives in `httpRoute.matcher.core.ts`.
  */
-import { normalizeMethod } from "../core/factory/httpRoute.factory.base.js";
+import { createOptionsResponse, normalizeMethod, } from "../core/factory/httpRoute.factory.base.js";
+import { normalizeMatchPath } from "../core/util/httpRoute.util.js";
 import { formatAllowHeader } from "../../httpMethods/http.methods.js";
 import { matchCompiledRoute } from "./httpRoute.matcher.core.js";
 /* -------------------------------------------------------------------------- */
@@ -31,14 +32,20 @@ export class RouteMatcher {
     match(request) {
         this.requests += 1;
         const method = normalizeMethod(request.method);
-        const path = normalizeRequestPath(request.path);
-        const direct = this.matchMethod(method, path);
+        /*
+         * The raw target is threaded through so a strict-trailing-slash route can
+         * still tell `/users` from `/users/`; only the reported path is
+         * normalized.
+         */
+        const target = request.path;
+        const path = normalizeRequestPath(target);
+        const direct = this.matchMethod(method, target);
         if (direct) {
             this.matches += 1;
             return direct;
         }
         if (method === "HEAD" && this.matcherOptions.allowHeadFallback) {
-            const fallback = this.matchMethod("GET", path);
+            const fallback = this.matchMethod("GET", target);
             if (fallback) {
                 this.matches += 1;
                 return {
@@ -48,13 +55,25 @@ export class RouteMatcher {
             }
         }
         if (method === "OPTIONS" && this.matcherOptions.allowOptionsFallback) {
-            const first = this.matchFirstAllowed(this.allowedMethods(path).methods, path);
-            if (first) {
+            const allowed = this.allowedMethods(target);
+            if (allowed.allowed) {
                 this.matches += 1;
-                return {
-                    ...first,
+                /*
+                 * The fallback must never carry an executable route. It used to
+                 * answer with the first route registered on the path under ANY
+                 * method, so `OPTIONS /accounts/42` ran the `DELETE` handler — past
+                 * any CSRF guard that treats `OPTIONS` as safe. The synthetic route
+                 * below owns no middleware and answers `204` with `Allow`, matching
+                 * what `HttpRouter.match()` already does.
+                 */
+                return Object.freeze({
+                    route: createOptionsRoute(path, allowed),
+                    params: Object.freeze({}),
+                    method,
+                    path,
+                    score: 0,
                     matchedBy: "options-fallback",
-                };
+                });
             }
         }
         this.misses += 1;
@@ -63,11 +82,12 @@ export class RouteMatcher {
     matchMethod(method, path) {
         const normalizedMethod = normalizeMethod(method);
         const normalizedPath = normalizeRequestPath(path);
+        const matchPath = normalizeMatchPath(path);
         for (const route of this.router.compiled()) {
             if (!methodApplies(route.definition.method, normalizedMethod)) {
                 continue;
             }
-            const params = matchCompiledRoute(route, normalizedPath, this.matcherOptions.caseSensitive);
+            const params = matchCompiledRoute(route, matchPath, this.matcherOptions.caseSensitive);
             if (!params) {
                 continue;
             }
@@ -80,23 +100,22 @@ export class RouteMatcher {
     /* ------------------------------------------------------------------------ */
     matchAll(request) {
         const method = normalizeMethod(request.method);
-        const path = normalizeRequestPath(request.path);
-        return this.collect(method, path);
+        return this.collect(method, request.path);
     }
     /* ------------------------------------------------------------------------ */
     /* Path Matching                                                            */
     /* ------------------------------------------------------------------------ */
     matchPath(path) {
-        return this.collect("*", normalizeRequestPath(path));
+        return this.collect("*", path);
     }
     /* ------------------------------------------------------------------------ */
     /* Allowed Methods                                                          */
     /* ------------------------------------------------------------------------ */
     allowedMethods(path) {
-        const normalizedPath = normalizeRequestPath(path);
+        const matchPath = normalizeMatchPath(path);
         const methods = new Set();
         for (const route of this.router.compiled()) {
-            const params = matchCompiledRoute(route, normalizedPath, this.matcherOptions.caseSensitive);
+            const params = matchCompiledRoute(route, matchPath, this.matcherOptions.caseSensitive);
             if (params) {
                 methods.add(route.definition.method);
             }
@@ -140,29 +159,22 @@ export class RouteMatcher {
     /* ------------------------------------------------------------------------ */
     collect(method, path) {
         const results = [];
+        const normalizedPath = normalizeRequestPath(path);
+        const matchPath = normalizeMatchPath(path);
         const seen = new Set();
         for (const route of this.router.compiled()) {
             if (!methodApplies(route.definition.method, method)) {
                 continue;
             }
-            const params = matchCompiledRoute(route, path, this.matcherOptions.caseSensitive);
+            const params = matchCompiledRoute(route, matchPath, this.matcherOptions.caseSensitive);
             if (!params || seen.has(route.definition.id)) {
                 continue;
             }
             seen.add(route.definition.id);
-            results.push(createResult(route, params, method, path));
+            results.push(createResult(route, params, method, normalizedPath));
         }
         return Object.freeze(results);
     }
-    matchFirstAllowed(methods, path) {
-        for (const method of methods) {
-            const result = this.matchMethod(method, path);
-            if (result) {
-                return result;
-            }
-        }
-        return undefined;
-    }
 }
 /* -------------------------------------------------------------------------- */
 /* Factory                                                                    */
@@ -200,6 +212,32 @@ function createResult(route, params, method, path) {
         matchedBy: route.definition.method === "*" ? "wildcard" : "exact",
     });
 }
+/**
+ * Builds the synthetic route an `OPTIONS` fallback resolves to.
+ *
+ * It carries no middleware and a handler that only answers `204` with the
+ * path's `Allow` header, so an `OPTIONS` request can never reach a handler
+ * registered for another method.
+ *
+ * @param path - The normalized request path.
+ * @param allowed - The methods registered on that path.
+ * @returns The synthetic route definition.
+ */
+function createOptionsRoute(path, allowed) {
+    const methods = allowed.methods.includes("OPTIONS")
+        ? allowed.methods
+        : [...allowed.methods, "OPTIONS"];
+    return Object.freeze({
+        id: "route:options-fallback",
+        method: "OPTIONS",
+        path,
+        name: undefined,
+        params: Object.freeze({}),
+        metadata: Object.freeze({}),
+        handler: () => createOptionsResponse(methods),
+        middleware: Object.freeze([]),
+    });
+}
 /* -------------------------------------------------------------------------- */
 /* Method Utilities                                                           */
 /* -------------------------------------------------------------------------- */